CVE-2025-15558 vulnerabilities

Vulnerabilities for packages: kargo, vendir, guac, lazydocker, osv-scanner, harbor, bento, spire-server, teleport, eksctl, openbao, paranoia, flux-helm-controller, kwok, cosign, traefik, witness, kyverno-notation-aws, aactl, flux, kyverno, nerdctl, rancher-system-agent, kbld, zot, kubeflow-katib,...

GHSA-VQF4-7M7X-WGFC vulnerabilities

Vulnerabilities for packages: debezium-connector-spanner, debezium-connector-informix, debezium-connector-db2, strimzi-kafka-operator, debezium-connector-ibmi, zipkin, spark, debezium-connector-vitess, cassandra, kafka, debezium...

CVE-2026-28799

PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17, a heap use-after-free vulnerability exists in PJSIP's event subscription framework evsub.c that is triggered during presence unsubscription SUBSCRIBE with Expires=0. This issue has been patched i...

image-builder security update

45-1.0.3 - Rebuilt to fix CVE-2025-61726, CVE-2025-61729, CVE-2025-68121...

SUSE CVE-2026-3536

Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Critical...

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

CVE-2026-3536

Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Critical...

GHSA-QJWF-H778-47MM vulnerabilities

Vulnerabilities for packages: libvips...

GHSA-33R2-HFPX-FX7H vulnerabilities

Vulnerabilities for packages: libvips...

GHSA-33R2-HFPX-FX7H vulnerabilities

Vulnerabilities for packages: libvips...

GHSA-QJWF-H778-47MM vulnerabilities

Vulnerabilities for packages: libvips...

ROS-20260304-73-0020

A vulnerability in the wledconfigure function of the Linux kernel is related to null pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

CVE-2026-25884

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8...

firefox: thunderbird: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component...

firefox: thunderbird: Use-after-free in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: ImageLib component...

firefox: thunderbird: Integer overflow in the Libraries component in NSS

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Libraries component in NSS...

firefox: thunderbird: Use-after-free in the JavaScript: GC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy

A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary...

GHSA-23C5-XMQV-RM74 vulnerabilities

Vulnerabilities for packages: ts-patch, opensearch-dashboards, tileserver-gl, pulumi, serve, kubeflow-katib, node-gyp, prism, npm, saf, code-server, vitess, renovate, eslint, py3-jupyterlab, argo-workflows, lerna, kubeflow-centraldashboard, pnpm-stage0...